MiExpenses
Get it on Google Play

Legal

Privacy policy

What the MiExpenses app and this website do with data. Written by reading the app and the server, not by filling in a template, so it names the things a template would have left out.

Last updated:

MiExpenses is built and run by one person, Alexander Volkov. There is no company behind it. He is the data controller for everything described here, and questions, requests for a copy of your data and deletion requests all go to the same address: [email protected].

It covers the MiExpenses Android app and this website. The website is static pages: it runs no scripts, loads no fonts, images or files from other hosts, and makes no request to anyone but the server that hands you the page. Reading it sets no cookies and tells nobody you were here. Everything below is about the app.

The app needs an account, so the first thing it asks for is an email address and a password, or a Google sign-in. Signing in with Google gives us the same one field: the app reads only the email address out of the Google credential, and the Google token itself stays on the phone. The rest is what you pick during onboarding.

Stored on the account:

  • Your email address. It is the account name, and the key everything else is stored under.
  • Your country. Chosen during onboarding, or filled in by the lookup described further down.
  • Your currency. Amounts entered in other currencies are converted into it for totals.
  • Your distance unit: kilometres or miles.
  • Your volume unit: litres, imperial gallons or US gallons.

Everything you enter about a vehicle and its costs is stored on our server, not only on your phone. That includes fields people often assume stay on the device.

  • Vehicle: name, type, make, model, year, engine size, tank sizes and fuel types, odometer reading, and, if you fill them in, the licence plate and the VIN.
  • Expense: date, category and subcategory, odometer, amount and currency, and the free-text comment.
  • Fill-up: on top of that, the price per unit, the volume, the fuel type, and the full tank and exclude from statistics flags.
  • Reminders, the expense subcategories you create, and sharing records.
  • Feedback sent from the app: the star rating, your text, and your user id.
  • Monthly limits and expense templates are the exception. They stay on the phone and are never sent to the server, which is also why a second phone does not show them.

Three things happen without you asking for them, and two of them cannot be switched off inside the app.

  • A push token. Firebase Cloud Messaging issues a token for your installation, and the app sends it to our server together with your email address, which is the key it is stored under. It is sent after you sign in, when the token changes, and after a reboot, whether or not you allowed notifications.
  • A country lookup by IP address. During onboarding, and at every start of the home screen with a working connection, the app asks a third-party service which country your IP address belongs to. It tries free.freeipapi.com first, then ipapi.co, then ipwho.is. Your IP address is what those services see. Nothing asks for your consent, there is no setting to turn it off, and the answer is written to your profile only when your country is not set yet.
  • Advertising. The Google Mobile Ads SDK is started every time the home screen opens, including sessions where no ad is ever requested. There is exactly one placement in the app: a full-screen rewarded video before the world statistics list opens, shown to accounts without the paid flag. The request is built with default settings, so it is not marked as non-personalised, and no consent form is shown. What that SDK gathers goes to Google, not to us, and Google's own terms cover it.

The Firebase Analytics SDK is part of the build, but a flag in the app's manifest switches data collection off. The app also sends no analytics events of its own: there is not one event or user-property call in its source.

There is no crash reporting and no performance monitoring at all: no Crashlytics, no third-party equivalent, and no home-made crash handler either. If the app crashes on your phone, no stack trace reaches us and we do not learn about it. The only way we hear about a problem is if you write to us.

The app has a screen that puts a vehicle next to the same make and model owned by other people. It works because our server keeps a row for every vehicle that qualifies and shows that list to other people using the app.

A vehicle joins the list only after at least ten records, thirty days of history, activity within the last sixty days and at least a thousand units of distance. Its make and model must also be in the server's catalogue, and the account must carry the paid flag on our side. The rows are not averaged together: each row is one vehicle.

What a row holds, and what it does not:

  • A numeric owner id, country, make, model and year of manufacture.
  • Totals for that vehicle: distance, fuel volume and cost.
  • It does not hold the licence plate, the VIN, your email address, or any individual expense.
  • There is no switch in the app that keeps your vehicle out of this list.

Everything the app stores goes to the developer's own servers over HTTPS. There are two entry points; the app chooses between them by itself, and you can pin one of them in settings. No third-party cloud storage is in the chain: no Google Drive, no Dropbox, no file service of any kind. This document does not name a country of storage, because that is a claim we cannot back with anything you could check.

Data leaves your phone to:

  • Our own backend, at hh.suxlv2.space and suxlv2.space, over HTTPS. Your account, vehicles, expenses, reminders, categories and sharing records live there.
  • Firebase Authentication, for email sign-in and Google sign-in.
  • Firebase Cloud Messaging, for the push token and for the wake-up messages that carry no personal data of their own.
  • Google AdMob, for the one rewarded video described above.
  • free.freeipapi.com, ipapi.co or ipwho.is, for the country lookup.

Traffic between the app and the server is HTTPS, and the released build refuses plain HTTP. Passwords are handled by Firebase Authentication and never reach our server, which has no password field and no password column; for email sign-in Firebase also requires a confirmed address. On the phone, the cached copy of your account record in the settings file is encrypted with AES/GCM under a key created and held in the Android Keystore, so it cannot be read out of a copied settings file.

That is the whole list, and it is worth being exact about what it is not. This is not end-to-end encryption and it is not zero knowledge: the data is readable on the server, and the developer can read it. The expense database on your phone is an ordinary unencrypted database, protected by Android's app sandbox and by the device encryption of the phone itself. Certificate pinning is not used. If a particular detail is sensitive enough that this matters, the safe answer is not to type it in.

You can give another registered person access to one of your vehicles at one of three levels: view, edit, or move ownership. Sharing works on a whole vehicle. Individual records cannot be held back from it.

  • The invitation is created from an email address you type, and that address is stored on our server as part of the sharing record.
  • A pending invitation already moves data. From the moment the invitation exists the server treats that account as having access, so their phone downloads and keeps the vehicle and its entries at its next sync. The app hides the vehicle from them until they accept, but the data is on their device by then.
  • Once accepted, they see the vehicle card, every expense and reminder attached to it including entries made by other participants, and your expense categories.
  • An entry marked Exclude from statistics is not a private entry. It is stored and synchronised like any other, it is visible to everyone the vehicle is shared with, and it appears in the CSV export.
  • Revoking access immediately removes the vehicle from the other person's app and stops them changing anything further. It does not reach into what their phone has already downloaded, and the sharing record itself stays on our server marked as deleted.
  • Transferring ownership is permanent and cannot be undone. The PIN that confirms it is stored on our server in plain text and compared without regard to case, so treat it as a handshake, not as a password.

From version 5.0.0 the app opts out of Android's backup framework: both the cloud backup into your Google account and device-to-device transfer are switched off for every part of the app's data. Versions up to and including 4.1.0 did not opt out, so if you have used the app for a while, a copy of its local database and settings may already sit in a Google backup. That copy is in your Google account rather than ours, and it is removed the way Google lets you remove app backups. Transfer tools built by phone manufacturers work outside the Android backup framework and are not covered by this setting.

Data stays on the server for as long as the account exists. Deleting a vehicle, an expense, a reminder, a category or a sharing record inside the app is a soft delete on the server: the row stops being shown and stops syncing, but it is kept and marked as deleted.

There is no delete-my-account screen in the app, and the server has no endpoint for it either. Deletion is a request by email to [email protected], answered by the one person who reads that address. That is the whole procedure, and pretending otherwise would be easier to write than to honour.

Concretely:

  • Delete inside the app: the entry leaves your app and the app of anyone you shared with, and is kept on the server marked as deleted.
  • Sign out: nothing is deleted anywhere. Entries still queued for upload are lost if you sign out before they are sent, and the app warns you about that first.
  • Uninstall: the local copy goes, including monthly limits and expense templates, which exist nowhere else. Signing in again brings back what the server holds; it does not bring back limits and templates.
  • Delete the account and its server-side data: write to [email protected].

You can ask what is stored about you, ask for a correction, ask for a copy, ask for deletion, or object to some of the processing. There is one address for all of it: [email protected]. Please write from the address the account is registered under, because that address is the only identifier we have for you.

  • Access and a copy. The app exports one vehicle at a time to CSV or to a PDF report, and the CSV is the fuller of the two. For anything the export does not cover, ask by email.
  • Correction. Most fields can be corrected in the app itself. Where they cannot, ask by email.
  • Deletion. By email, as described in the section above.
  • Objection. By email, including an objection to your vehicle appearing in the world statistics list: there is no switch in the app for that, so it has to be a request.

When this document changes, the date at the top of the page changes with it, and that date is the only marker: the app does not push policy updates at you. If a change ever means something new is collected, it will be described here in the same detail as everything else, before the change reaches the app.